php - safest way to ensure plain text

Question

What is the most secure way to stop users adding html or javascript to a field. I am adding a youtube style 'description' where users can explain their work but I don't want anything other than plain text in there and preferable none of the htmlentities rubbish like '<' or '>'.

Could I do something like this:

$clean = htmlentities($_POST['description']);

if ($clean != $_POST['description']) ... then return the form with an error?

Answer 1

Have you seen strip_tags?

Answer 2

strip_tags() would probably be the best bet.

You don't need to check the cleaned code vs the original and throw an error. As long as it is cleaned, you should be able to display it. Just throw away the original comment. You can put a note under the textbox saying that no html is allowed if you want to make it more user friendly.

Answer 3

Use strip_tags() instead htmlentities().
And the method is ok.

Answer 4

Also don't forget mysql_real_escape_string() if you are storing data in MySQL.

Answer 5

htmlspecialchars(), if used properly (see comments), is the safest way to ensure plain text. There is no way to inject any HTML or JavaScript when the output has all the HTML special characters escaped. If you use strip_tags, you will prevent your users from using completely legitimate characters.